fix: Move /var/run/dstack.sock to /var/run/dstack/dstack.sock directory

[kvinwang]

Problem

When containers mount the socket file directly (e.g., -v /var/run/dstack.sock:/var/run/dstack.sock), the socket becomes inaccessible after guest-agent restarts.

Root Cause

Docker's bind mount locks the inode at container start time, not the path. When guest-agent restarts:

1. Rocket's Unix socket handling acquires an exclusive lock on <path>.lock
2. If reuse=true (default), it deletes the existing socket file via remove_file()
3. Creates a new socket via bind() - this creates a NEW inode
4. The container still holds the old inode, which no longer has any listener

Why Rocket Deletes the Socket

Unlike TCP sockets, Unix Domain Sockets do not support SO_REUSEADDR. The bind() syscall requires the path to not exist - if the socket file already exists, bind() fails with EADDRINUSE.

Rocket's reuse option is a workaround that simulates TCP-like behavior by:

1. Acquiring a file lock to prevent races
2. Deleting the existing socket file
3. Creating a new socket

This "delete and recreate" approach is necessary for UDS but breaks Docker's file-based mounts.

Relevant Rocket code (unix.rs:32-72):

pub async fn bind<P: AsRef<Path>>(path: P, reuse: bool) -> io::Result<Self> {
    let lock = if reuse {
        // ...acquire exclusive lock...
        if path.exists() {
            tokio::fs::remove_file(&path).await?;  // <-- Deletes old socket!
        }
        Some(lock_file)
    };
    let listener = tokio::net::UnixListener::bind(&path);  // <-- Creates new inode
    // ...
}

Solution

1. Move guest-agent to listen on new paths

Old Path	New Path
/var/run/dstack.sock	/var/run/dstack/dstack.sock
/var/run/tappd.sock	/var/run/dstack/tappd.sock

2. Systemd socket proxy for backward compatibility

For containers that mount the old paths, we use systemd socket activation with systemd-socket-proxyd:

Container → /var/run/dstack.sock (systemd-owned) → proxy → /var/run/dstack/dstack.sock (guest-agent)

Key insight: systemd.socket creates and owns the socket file, not the service process. This means:

• The socket file persists across proxy service restarts
• The inode never changes
• Containers mounting /var/run/dstack.sock continue to work even after guest-agent restarts

Files added:

• dstack-socket.socket + dstack-socket.service
• tappd-socket.socket + tappd-socket.service

3. SDK Fallback

All SDKs (Rust, Python, JS, Go) try the new path first, falling back to the old path for compatibility with older guest-agent versions.

User Impact

None - Apps can continue using /var/run/dstack.sock and /var/run/tappd.sock as before. The systemd socket proxy handles the forwarding transparently.

Changes

• guest-agent/dstack.toml: Updated socket paths to /var/run/dstack/
• dstack-util/src/system_setup.rs: Create /var/run/dstack/ directory
• basefiles/: Added systemd socket + proxy service files for backward compatibility
• SDK updates: Rust, Python, JS, Go clients try new path first with fallback